408_Hack_the_Stack_02.qxd 9/22/06 5:32 PM Page 27 Chapter 2 Layer 1: The Physical Layer Solutions in this chapter: ■ Defending the Physical Layer ■ Attacking the Physical Layer ■ Physical Layer Security Project Summary Solutions Fast Track Frequently Asked Questions 27 408_Hack_the_Stack_02.qxd 9/22/06 5:32 PM Page 28 28 Chapter 2 • Layer 1: The Physical Layer Introduction The physical layer (layer 1) sits at the bottom of the Open Systems Interconnect (OSI) model, and is designed to transmit bit streams using electric signals, lights, or radio transmissions. For this chapter, the definition of the physical layer is expanded to include all physical things.True security means building defense-in- depth, which is used in this chapter to expand the OSI concept on a much broader scale. We begin by looking at some of the methods used to defend the physical environment, including common concepts such as lights, locks, and guards. Next, we examine the attacks on the physical layer, which are different from attacks on all of the other layers, therefore requiring different defensive techniques and skills. We believe that physical security should encompass the wiring used to connect systems as well as the system hardware, supporting ser- vices, employees, and any other physical assets. Defending the Physical Layer This section examines ways to defend the physical layer. Physical security is the point at which protection should begin. How much physical security you need depends on your sit- uation, assets, and budget.These security controls have three primary goals: ■ Deter Two methods used to deter intruders are security lighting and “Beware of Dog” signs. ■ Delay Some of the techniques used to delay an intruder include fences, gates, locks, access controls, and mantraps. ■ Detect Two systems used to detect intruders are intrusion detection systems (IDSes) and alarms. Physical security (layer 1) should be viewed differently than the controls and vulnerabili- ties at higher layers.The higher layers deal primarily with security controls designed to pre- vent disclosure, denial, or alteration of information. Physical security focuses on intruders, vandals, and thieves. Physical security combined with technical security and administrative controls provides a holistic view of security, as seen in Figure 2.1. Physical security is the oldest aspect of security. In ancient times, physical security was a primary concern of those with assets to protect. Consider the concept of castles, walls, and moats. While primitive, these controls were clearly designed to delay attackers. Physical secu- rity is a vital component of any overall security program. www.syngress.com 408_Hack_the_Stack_02.qxd 9/22/06 5:32 PM Page 29 Layer 1: The Physical Layer • Chapter 2 29 Figure 2.1 Physical, Technical, and Administrative Controls Design Security Design security should begin during the design phase, not at the time of deployment. It is usually done when designing new code or applications; some organizations follow the System Design Life Cycle (SDLC) to build security in at every step of software design.This section discusses extending that concept to the physical realm.The physical security of assets and employees should be considered when designing a new facility; well-designed facilities are comfortable and secure. Location is a key consideration. If you are offered a great deal on an office building in a bad part of town, do the high crime rate, employee security, and potential for loss or theft make it a viable option? Construction is another key issue (e.g., the increase of hurricanes that have hit Florida demonstrates that building substandard facilities can be devastating. Some facilities designed for category 5 hurricanes failed during category 3 storms). For the most part, construction is governed by local, state, and federal laws; however, there are still items that you should watch for. If you are moving into a preexisting facility, pay careful attention to what it was originally designed for (e.g., storage facilities have different require- ments than clean rooms). NOTE In 1998, President Bill Clinton signed Presidential Decision Directive 63 (PDD-63), which provides the structure that key industries must follow when imple- menting security controls to prevent logical and physical attacks. www.syngress.com 408_Hack_the_Stack_02.qxd 9/22/06 5:32 PM Page 30 30 Chapter 2 • Layer 1: The Physical Layer Accessibility is also important. Requirements will vary depending on your business and individual needs; however, roads, freeways, local traffic patterns, and convenience to regional airports should always be considered. Climatology is another important issue.A building in San Francisco does not have the same weather concerns as a building in Anchorage. Events such as hurricanes, floods, snow- storms, dust storms, and tornados should be discussed and planned prior to the start of con- struction. Other items to consider when designing a facility include: ■ Transportation Is the facility easy to get to? How is the traffic? Are there any airports or freight lines located in the vicinity? ■ Utilities Is there access to more than one electric provider? Is a redundant T1 available? ■ Access Control The design of the physical environment and the proper layout of access controls can increase security.The discipline known as Crime Prevention Through Environmental Design (CPTED) is built around this concept. Perimeter Security The first line in a defense-in-depth model is the perimeter, which prevents unauthorized individuals from gaining access to the facility. Even if someone does circumvent the first layer, additional layers deter, detect, and delay them, thereby preventing them from gaining access to critical assets. If building a new facility, you may be able to include many of these controls. If you are charged with protecting an existing facility, a risk assessment is required to determine how to increase current security. In both new and old facilities, the goal is to design security controls so that a breach of any one defensive layer does not compromise the physical security of the entire organization. Perimeter security controls can be physical bar- riers (e.g., a wall, a card-controlled entry, or a staffed reception desk). Perimeter security requires you to examine: ■ Natural boundaries at the location ■ Fences or walls around the site ■ The design of the outer walls of a building ■ Divisions and choke points within a building To enhance the physical security of the perimeter and to physically and psychologically deter intruders, a series of mechanisms can be employed, including: ■ Fences ■ Perimeter Intrusion Detection and Assessment Systems (PIDAS) ■ Security lighting www.syngress.com 408_Hack_the_Stack_02.qxd 9/22/06 5:32 PM Page 31 Layer 1: The Physical Layer • Chapter 2 31 ■ Closed-circuit television (CCTV) ■ Security guards and guard dogs ■ Warning signs and notices Fencing Fencing is a key component of perimeter security.A fence with the proper design and height can delay an intruder and work as a psychological barrier. NOTE In 1969, security failed at the first Woodstock concert when eager concertgoers knocked down yards of poorly constructed hurricane fence, thus allowing thou- sands of people to enter the concert area without paying. Before installing a fence, a risk analysis should be performed to evaluate the types of physical assets to be protected.A 4-foot fence will deter a casual trespasser, but an 8-foot fence will keep a determined intruder out.Adding three-strand barbwire to the top increases security even more. Two more factors to consider are the gauge and mesh size of the wire. When consid- ering a chain link fence, remember that the smaller the mesh, the more difficult it is to climb, and the heavier the gauge, the more difficult it is to cut.Table 2.1 details the security of various types of chain link fences. For more information on fences and their level of secu- rity go to the Chain Link Fence Manufacturers Institute at http://codewriters.com/asites/page.cfm?usr=clfma&pageid=887. Table 2.1 Security of Chain Link Fence Types Type Security Mesh Gauge A Extremely High Security 3/8 inch 11 gauge B Very High Security 1 inch 9 gauge C High Security 1 inch 11 gauge D Greater Security 2 inch 6 gauge E Normal Fencing 2 inch 9 gauge To take security to the next level, install a PIDAS, which has sensors that detect intruders and feel vibrations along the fence.The downside is that the system can produce false positives due to stray deer, high winds, or other natural events. www.syngress.com 408_Hack_the_Stack_02.qxd 9/22/06 5:32 PM Page 32 32 Chapter 2 • Layer 1: The Physical Layer Gates, Guards, and Grounds Design There are other items to consider when securing the perimeter. One is choosing the proper gate, which serves as the access point or open port. Gates act as choke points to control the flow of people and vehicles. UL Standard 325 details the requirements for gates, which are divided into the following four classifications: ■ Residential Class 1 ■ Commercial Class 2 ■ Industrial Class 3 ■ Restricted Access Class 4 Another way to prevent vehicles from entering restricted areas is by using bollards. Bollards are made of concrete or steel and are used to block vehicular traffic or to protect areas where pedestrians are entering and leaving buildings.After the bombing of the federal building in Oklahoma City in November 1995, many government and commercial entities installed bollards to prevent vehicles from ramming buildings. Companies now make bollards with electronic sensors that notify building inhabitants if someone has rammed or breached the bollards. Bollards are the second line of defense, because they can deter individuals from ramming a facility with a motor vehicle. Another way to secure the perimeter is using security guards. Some type of background check should be performed on these individuals.At a minimum, security guard applicants should have job references and be subject to a background check.